Search: CVE-2026-75899

CVE-2026-75899 is a vulnerability in the fast-uri Node.js library used by Red Hat products such as Red Hat Satellite's Lightspeed component. The flaw involves double decoding of percent escapes in hostnames during URI parsing, which can allow an attacker to manipulate URIs to redirect requests to unintended network destinations, including internal services. This can lead to Server-Side Request Forgery (SSRF) and bypass of host-based security policies. No fix is currently available that meets Red Hat's criteria for deployment and stability. The vulnerability is rated as high severity by Red Hat.